ci-cd

CI/CD DevOps Standards

Quick Navigation: Level 1: Quick Start (5 min) → Level 2: Implementation (30 min) → Level 3: Mastery (Extended)

Level 1: Quick Start (<2,000 tokens, 5 minutes)

Core Principles

1. Automate Everything: Build, test, security scan, and deploy automatically
2. Fail Fast: Detect issues early with comprehensive testing gates
3. Security First: Scan dependencies, containers, and code for vulnerabilities
4. Reproducible Builds: Same code → same artifact every time
5. Rapid Rollback: Deploy with confidence, roll back quickly if needed

Essential Checklist

• Continuous Integration: Automated builds and tests on every commit
• Testing Gates: Unit tests pass (>80% coverage), integration tests pass
• Security Scanning: Dependency vulnerabilities checked, SAST enabled
• Artifact Management: Built artifacts stored with version tags
• Deployment Automation: One-click deploy to staging/production
• Rollback Strategy: Automated rollback on deployment failure
• Monitoring: Pipeline metrics, build success rates tracked
• Secrets Management: No hardcoded secrets, use vault/parameter store

Quick Example (GitHub Actions)

# .github/workflows/ci.yml
name: CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run linters
        run: npm run lint

      - name: Run tests
        run: npm test -- --coverage

      - name: Check coverage threshold
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
            echo "Coverage $COVERAGE% is below 80% threshold"
            exit 1
          fi

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run security audit
        run: npm audit --audit-level=high

      - name: SAST scan
        uses: github/codeql-action/analyze@v2

  build:
    needs: [test, security]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan container
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

      - name: Push to registry
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          docker tag myapp:${{ github.sha }} registry.example.com/myapp:${{ github.sha }}
          docker push registry.example.com/myapp:${{ github.sha }}